Kibana 4.4 how to "combine/join" queries?

Elastic Stack Kibana
1

Hello,

I would like to know how to make a query and reused an already "saved search(es)".

As an example, i had already defined 2 queries:

  • query1: "known events"
  • query2: "already_resolved_events"

I wish to identify any "new events" so to make a new like query3 = events not in (query1, query2)
and also another one like query4 = events in (query1, query 2).

How to make such queries?

PS: the idea here is NOT to duplicate events in all filter but to keep update only 1 list of event (either known or already_resolved)...

Thanks in advance for your help

2

Sorry @teubreu but that isn't possible in Kibana right now.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.